When using the portal anonymously, it seems to be possible to enter an internal username. When this comes through to the portal, it would appear to come from a genuine, logged on user. Clearly this is a risk. How do you open the portal to be anonymous, whilst restricting what can be entered in the "Email confirmation to" field by an anonymous user?
